-5

I have a redirect rule on my CSF like the below;

17.1.1.13|80|27.5.5.22|80|tcp

17.1.1.13 is my firewall(csf) and 27.5.5.22 is my web server address. So everybody access my web site through the firewall. Blocking a redirect rule on CSF (iptables)

And I've been trying to block 50.30.0.0/16 CIDR block and it has been added to my csf.deny file.

Now, if I try to visit web site using 44.5.6.7 ip address I can. Although 50.30.0.1 is blocked, I can access web site using the ip address. I want to block 50.30.0.1 in all circumstances.

Related lines of my iptables like the below. What should I do?

Chain DENYIN (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 LOGDROPIN  all  --  !lo    *       50.30.0.0/16          0.0.0.0/0           

Chain DENYOUT (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 LOGDROPOUT  all  --  *      !lo     0.0.0.0/0            50.30.0.0/16 

Chain PREROUTING (policy ACCEPT 7 packets, 336 bytes)
num   pkts bytes target     prot opt in     out     source               destination   
1        0     0 REDIRECT   tcp  --  !lo    *       50.30.0.0/16          0.0.0.0/0 
2        0     0 REDIRECT   tcp  --  !lo    *       50.30.0.0/16          0.0.0.0/0      
3        0     0 DNAT       tcp  --  !lo    *       0.0.0.0/0            17.1.1.13
4        0     0 DNAT       tcp  --  !lo    *       0.0.0.0/0            17.1.1.13

Chain POSTROUTING (policy ACCEPT 6 packets, 699 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 SNAT       tcp  --  *      !lo     0.0.0.0/0            27.5.5.22 
2        0     0 SNAT       tcp  --  *      !lo     0.0.0.0/0            27.5.5.22
Improve this question
17
  • Can you post the output of iptables -vL ?
    – eltrai
    May 22, 2015 at 8:43
  • 2
    Actually if you have rule like -s 0.0.0.0 -j ACCEPT and then you append a rule with DROP statement, then you drop statement wont work. In iptables rules order does matter!
    – Navern
    May 22, 2015 at 8:52
  • 1
    Your ruleset is insanely complex, and I don't think you understand it. I'm not sure I do. E.g., INPUT rules 28-31 inclusive are identical, so the last three of those are therefore completely redundant. Rules 28 and 33 between them permit just about everything, so no blocking statement after that will have any effect. If you want to write your own rules, you will need to write all of them, or at least understand why they're all there.
    – MadHatter
    May 22, 2015 at 9:17
  • 1
    @user3765109 You cannot reduce load on a congested network link by blocking packets which have already come through that link. And if it happens to be a reflection attack, your blocking is going to suppress those ICMP errors which could provide indication of the attack to those who can do something about it.
    – kasperd
    May 22, 2015 at 10:46
  • 1
    Hello @PavelK, actually I have a firewall (IP:1.1.1.1) and a webserver (IP: 2.2.2.2). Under normal circumstances, when someone try to 1.1.1.1 he can access my web site. There are DNAT and SNAT rules. However, I want to block IP 5.5.5.5. If someone -who has 5.5.5.5 IP address- wants to access my web site he shouldn't get access to my web site. This is the main problem :)
    – efkan
    May 22, 2015 at 11:48

1 Answer 1

Reset to default
1

When you use a -A (for APPEND) iptables command, your rule is added at the end of the table.

The way rules are evaluated are from the first to the last, and any matching rule that results in a decision (ACCEPT, REJECT, DENY) stops the evaluation of any subsequent rule.

So here, what happen is that your DROP rule will never matter, since if iptables evaluates it, it would have gone to the DROP policy anyway.

You need to add your rule before any ACCEPT rule you would like the corresponding IP address to not be able to access. I would guess as first rule in your case.

Which would be something like 

iptables -I INPUT -s 5.254.0.0/16 -j DROP

It will add the rule at the beginning of the table, therefore considering it before anything else and ignoring the rest of your rules for any matching IP, which packets will be dropped.

Note that if you need to be more precise into where you which your rule inserted, you can specify a pôsitional number just after the -I.

Improve this answer
1
  • Thank you. I've tried to input rule using -A and then -I parameters separately. It doesn't work for me but I gave reputation because of I learned somethings from your answer.
    – efkan
    May 22, 2015 at 10:15

Not the answer you're looking for? Browse other questions tagged .